Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.899exploits catalogados
40.763CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.463Exploit-DB 24.489GitHub PoC 18.324VulnCheck XDB 10.507Nuclei 4577Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.463 exploits
Referência
CVE-2018-7355
CVE-2018-7355—
All versions up to V1.0.0B05 of ZTE MF65 and all versions up to V1.0.0B02 of ZTE MF65M1 are impacted by cross-site scrip
23RIESGO
abrir ↗
Referência
CVE-2013-10051
CVE-2013-10051CRITICAL
InstantCMS <= 1.6 Remote PHP Code Execution
63RIESGO
abrir ↗
Referência
CVE-2013-10051
CVE-2013-10051CRITICAL
InstantCMS <= 1.6 Remote PHP Code Execution
63RIESGO
abrir ↗
Referência
CVE-2013-10051
CVE-2013-10051CRITICAL
InstantCMS <= 1.6 Remote PHP Code Execution
63RIESGO
abrir ↗
Referência
CVE-2025-6121
CVE-2025-6121CRITICAL
D-Link DIR-632 HTTP POST Request get_pure_content stack-based overflow
48RIESGO
abrir ↗
Referência✓ VexDay Proof
EggBlog 3.1.0 - Cookies SQL Injection
CVE-2008-0159—webappsphp
SQL injection vulnerability in index.php in eggBlog 3.1.0 and earlier allows remote attackers to execute arbitrary SQL c
23RIESGO
abrir ↗
Referência
CVE-2026-76557
CVE-2026-76557MEDIUM
WP Import Export Lite < 3.9.33 - Authenticated SQLi via Import Options
33RIESGO
abrir ↗
Referência
CVE-2026-67181
CVE-2026-67181MEDIUM
Rouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Transfer-Encoding Header
33RIESGO
abrir ↗
Referência✓ VexDay Proof
SCMS 1 - Local File Inclusion
CVE-2009-0330—webappsphp
Directory traversal vulnerability in index.php in Simple Content Management System (SCMS) 1 allows remote attackers to i
23RIESGO
abrir ↗
Referência✓ VexDay Proof
pastelcms 0.8.0 - Local File Inclusion / SQL Injection
CVE-2009-1405—webappsphp
Directory traversal vulnerability in index.php in PastelCMS 0.8.0, when magic_quotes_gpc is disabled, allows remote atta
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Ruby 1.9 - regex engine Remote Socket Memory Leak
CVE-2008-3443—dosmultiple
The regular expression engine (regex.c) in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, an
28RIESGO
abrir ↗
Referência
CVE-2026-11507
CVE-2026-11507MEDIUM
CodeAstro Leave Management System delete_leave_type.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2017-14757
CVE-2017-14757—
OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might b
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Dagger CMS 2008 - 'dir_inc' Remote File Inclusion
CVE-2008-6636—webappsphp
PHP remote file inclusion vulnerability in skins/default.php in Geody Labs Dagger - The Cutting Edge r12feb2008, when re
23RIESGO
abrir ↗
Referência
CVE-2009-3424
CVE-2009-3424—
Multiple PHP remote file inclusion vulnerabilities in MaxCMS 3.11.20b, when register_globals is enabled, allow remote at
23RIESGO
abrir ↗
Referência
CVE-2010-1744
CVE-2010-1744—
SQL injection vulnerability in product.html in B2B Gold Script allows remote attackers to execute arbitrary SQL commands
23RIESGO
abrir ↗
Referência
CVE-2016-1002
CVE-2016-1002—
Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577
28RIESGO
abrir ↗
Referência
CVE-2017-15287
CVE-2017-15287—
There is XSS in the BouquetEditor WebPlugin for Dream Multimedia Dreambox devices, as demonstrated by the "Name des Bouq
38RIESGO
abrir ↗
Referência
CVE-2026-115801
CVE-2026-115801MEDIUM
Kakao khaiii JSON Config File Linear.cpp open out-of-bounds
33RIESGO
abrir ↗
Referência
CVE-2013-4867
CVE-2013-4867—
Electronic Arts Karotz Smart Rabbit 12.07.19.00 allows Python module hijacking
23RIESGO
abrir ↗
Referência
CVE-2026-73678
CVE-2026-73678CRITICAL
MindsDB Minds Platform v26.1.0 Unauthenticated RCE via scratchpad exec()
48RIESGO
abrir ↗
Referência
CVE-2015-5399
CVE-2015-5399—
Cross-site scripting (XSS) vulnerability in PHPVibe before 4.21 allows remote authenticated users to inject arbitrary we
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Easy Photo Gallery 2.1 - Cross-Site Scripting / File Disclosure/Bypass / SQL Injection
CVE-2008-6988—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in Easy Photo Gallery (aka Ezphotogallery) 2.1 allow remote attacker
23RIESGO
abrir ↗
Referência
CVE-2018-11124
CVE-2018-11124—
Cross-site scripting (XSS) vulnerability in Attributes functionality in Open-AudIT Community edition before 2.2.2 allows
23RIESGO
abrir ↗
Referência
CVE-2026-72741
CVE-2026-72741HIGH
Rainbond 6.9.7 Region API Cross-Enterprise IDOR via Tenant Access
41RIESGO
abrir ↗
Referência
CVE-2021-24405
CVE-2021-24405—
Easy Cookie Policy <= 1.6.2 - Broken Access Control to Stored Cross-Site Scripting
28RIESGO
abrir ↗
Referência✓ VexDay Proof
bcoos 1.0.13 - 'viewcat.php' SQL Injection
CVE-2008-6381—webappsphp
SQL injection vulnerability in modules/adresses/viewcat.php in bcoos 1.0.13, and possibly earlier, allows remote authent
23RIESGO
abrir ↗
Referência
CVE-2009-4659
CVE-2009-4659—
Unspecified vulnerability in MP3-Cutter Ease Audio Cutter 1.20 allows user-assisted remote attackers to cause a denial o
23RIESGO
abrir ↗
Referência
CVE-2012-4251
CVE-2012-4251—
Multiple cross-site scripting (XSS) vulnerabilities in MySQLDumper 1.24.4 allow remote attackers to inject arbitrary web
23RIESGO
abrir ↗
Referência
CVE-2026-115800
CVE-2026-115800MEDIUM
UbiquitousLearning mllm Convertor __init__.py load_model path traversal
33RIESGO
abrir ↗
← anteriorpágina 759 / 883siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.